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Within the broad research scenario of quantum secure communication, Two-Way Quantum Key Distribution 
(TWQKD) is a relatively new proposal for sharing secret keys that is not fully explored yet. We analyse the 
security of TWQKD schemes that use qubits prepared in non-orthogonal states to transmit the key. Investigating 
protocols that employ an arbitrary number of bases for the channel preparation, we show, in particular, that the 
security of the LM05 protocol can not be improved by the use of more than two preparation bases. We also 
provide a new proof of unconditional security for a deterministic TWQKD protocol recently proposed [Phys. 
Rev. A 88, 062302 (2013)]. In addition, we introduce a novel deterministic protocol named “TWQKD six-state” 
and compute an analytical lower bound (which can be tightened) for the maximum amount of information that 
an eavesdropper could extract in this case. An interesting advantage of our approach to the security analysis of 
TWQKD is the great simplicity and transparency of the derivations. 


I. INTRODUCTION 

Quantum Key Distribution (QKD) harnesses the laws of 
Quantum Mechanics to distribute a secret key with a security 
level unachievable by classical means IBS. In a QKD pro¬ 
tocol two parties, commonly called Alice (message sender) 
and Bob (message receiver), want to establish a secret key 
between them, by sending quantum and classical information 
through an insecure channel. The communication channel can 
be spied by a powerful eavesdropper, typically called Eve, 
who is assumed to be technologically much more advanced 
than Alice and Bob. Thus, Eve can listen all the transmitted 
classical messages and manipulate the quantum information 
at her own will, in principle, being only limited by the laws 
of Quantum Physics. However, this manipulation unavoid¬ 
ably introduces perturbations of quantum nature, which may 
be detected by the communication partners (Alice and Bob), 
depending on the features of the communication protocol they 
are employing. In such a way, they are able to determine how 
much information was leaked and keep only the secure part in 
the final secret key. 

Standard QKD protocols (One-Way protocols), such as 
BB84 EHH, six-state [fTOl 111 and and SARG04 ll9lfT2DT4i. 
use an encoding method that prevents Bob to decode the in¬ 
formation in a deterministic way. This means that a fraction 
of the transmitted key bits must be discarded, due to the fact 
that Bob’s measurements do not allow him to deduce with cer¬ 
tainty the corresponding values. On the other hand, Two-Way 
Quantum Key Distribution (TWQKD) protocols liTsHTfl can 
provide a solution to this flaw. In this kind of protocols the 
preparation of the quantum states that will be encoded is car¬ 
ried out by Bob. Therefore, with this additional knowledge, 
he can always perform the right decoding measurements and 
no bits must be discarded. An important factor to assess the 
performance of a given QKD protocol is the key rate, that is, 
the number of secret key bits distributed per unit of time. Be¬ 
sides the improvements related to technological developments 
El, the use of qudits instead of two-level systems has been 
proposed as an option to achieve larger secret key rates l23l . 
TWQKD protocols have also the potential to fulfill this goal. 


given that the key bits can be decoded more efficiently than 
with One-Way schemes. 

Regarding security, it was recently shown that the per¬ 
formance of some TWQKD protocols is comparable to that 
of their One-Way counterparts and can even surpass it Q3. 
The two paradigmatic TWQKD schemes proposed to date are 
LM05 (based on non-orthogonal states) m and the Ping- 
Pong protocol (based on entanglement) fl5l . both of them be¬ 
ing deterministic. In spite that the original Ping-Pong protocol 
is vulnerable to zero error attacks El El, there exists a non- 
deterministic version that overcomes this shortcoming and has 
been proven secure ma. On the other hand, security proofs 
for LM05 and a deterministic TWQKD protocol inspired on 
it (LM05’) are given in 1261 [27 1 and fT9l , respectively. 

In this work we investigate the security of several TWQKD 
schemes based on non-orthogonal states, including determin¬ 
istic and non-deterministic ones. The proofs that we construct 
guarantee security against collective attacks, when the clas¬ 
sical post-processing is implemented with “direct reconcilli- 
ation” 0. In Section II we describe the basic structure of 
the protocols studied here. In Section III we present a sim¬ 
ple TWQKD protocol, whose security proof constitutes the 
basis of some subsequent results. Next, we prove in Section 
IV the security of the LM05’ protocol, by introducing a slight 
modification that reduces the corresponding analysis to that 
of the scheme described in Section III. Finally, Section V is 
focused on the study of two new deterministic TWQKD pro¬ 
tocols. One of them can be seen as a generalization of the 
LM05 protocol, due to the use of more than two preparation 
bases. We prove that the security of this generalized protocol 
is the same of LM05. For the latter protocol, which we term 
“TWQKD six-state”, we provide a lower bound for the eaves¬ 
dropping information that coincides with the corresponding 
to the six-state protocol lf2l l28l l29l . The security of the novel 
TWQKD six-state protocol is at least as good as that of LM05’ 
and probably even bigger (considering the tightness of the 
bound tracked down). All the calculations are performed an¬ 
alytically, showing explicitly the attacks that allow Eve to get 
a given amount of information. We take advantage of the so 
called Gram matrix formulation lf3Ql in our analysis. 
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H. GENERAL STRUCTURE OF THE TWO-WAY 
PROTOCOLS INVESTIGATED 


The basic modus operandi of the protocols considered here 
is the following (see Fig. [T]for a general description): 

1. Bob (the message receiver) prepares the f-th qubit state 
from a basis set {|0-,)}/, according to some probability 
distribution, and sends it to Alice through the quantum 
forward channel (QFC). 

2. Alice (the message sender) performs the Encoding 
Mode (EM) with probability p e and Control Mode 
(CM) with probability p c (p e + p c = 1)- In EM she 
encodes one bit of information, by randomly applying 
unitary operations from a predetermined set {f/ A };, and 
sends back the qubit to Bob through the quantum back¬ 
ward channel (QBC). Instead, in CM, she measures the 
received qubit in a given basis, by choosing randomly 
among the possible preparation bases used by Bob, to 
get information about the prepared state. It is important 
to note that the QFC and the QBC are the same phys¬ 
ical channel and the distinction is used to facilitate the 
description of the eavesdropping attacks. 
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Figure 1. (Color online) Schematic illustration of the quantum part 
of the general TWQKD protocol, with Alice at the left side, Bob at 
the right side and a eventual eavesdropper (Eve) at the center (the 
classical communication channel is omitted). The states {|^,-)),- and 
the unitary operations {(/ A ); are chosen probabilistically by Bob and 
Alice, respectively. Bob performs the decoding measuring the qubit 
in the preparation basis and for CM Alice measures the received qubit 
in any of the possible preparation bases (randomly chosen). Alice 
also chose randomly between EM and CM with probabilities p e and 
p c , respectively. See the general protocol description in the main text 
for more details. 


III. SECURITY ANALYSIS FOR A SIMPLE TWQKD 
PROTOCOL 


3. Bob measures the qubit in the f-th preparation basis to 
decode the information. 

4. After all the qubits have been transmitted and measured, 
a leftover part of the protocol is carried out through¬ 
out a classical channel. Alice publicly reveals which 
qubits were used for CM and which ones for EM. In the 
case of CM Alice and Bob compare the prepared states 
and the measurement outcomes, whenever Alice’s mea¬ 
surements had been performed properly in the prepara¬ 
tion basis. This procedure allows them to establish the 
forward noise Qf, defined as the probability that such 
states don’t match up. On the other hand, a fraction of 
the systems used for EM is randomly chosen to deter¬ 
mine the probability that encoded and decoded symbols 
be different, Q, the overall noise. The remaining sym¬ 
bols are not disclosed and constitute what is known as 
the “raw key”. 

5. Classical post-processing : Alice and Bob interchange 
additional classical information in order to obtain iden¬ 
tical and completely secret bit strings starting from their 
raw keys. To this aim two sub-protocols are required. 
The first is called “error correction” eh and it is used 
to amend the errors associated to the overall noise Q. 
In this way, the encoded and decoded keys become per¬ 
fectly correlated, i.e., Alice’s and Bob’s bits are iden¬ 
tical. In the following sub-protocol information po¬ 
tentially leaked during the quantum transmission is re¬ 
moved from the key, which is known as “privacy ampli¬ 
fication’ ’E2- Here we will consider the usual approach 
for the classical post-processing, where the involved 
sub-protocols are implemented with one-way classical 
communication (see, e.g., f33l for a different approach). 


A. General eavesdropper attack and security proof 

Let us consider a generic TWQKD protocol where Alice 
uses the encoding operations set {I A , of] (the bits “0” and “1” 
are encoded with the application of the unitary operation ~ A 
and of, respectively) and Bob’s preparation is such that Eve 
observes the state I A /2 in the QFC. In what follows we will 
denote operators acting on the encoded qubit Hilbert space 
with the superscript A. Other details, such as the preparation 
bases used by Bob, are irrelevant by now. For keys of infinite 
size, the secret fraction, r, is given by (34l[35l 

r = I(A . B) - I E = \ - h(Q) - I E , (1) 

where I(A : B ) is the mutual information between Alice’s and 
Bob’s data, which measures the correlation of the encoded 
and decoded keys. If Alice sends one bit, i.e., she uses I A 
and tr A with equal probability, I(A : B) — 1 - h(Q), being 
h(x) = -x log 2 (x) ~ (1 _ x) log 2 ( 1 - x) the binary entropy and 
Q the probability of miss-matching between the encoded and 
decoded bit. Here, we assume (as usual) that the quantum 
channel is a depolarizing channel ll36l and hence Q does not 
depend on the specific states carrying the information. More¬ 
over, Ie represents the maximum information that the eaves¬ 
dropper (Eve) can obtain using her best strategy (the expres¬ 
sion for Ie will be presented latter). 

We consider the case of collective attacks and classical 
post-processing implemented with “direct reconciliation”, im¬ 
plying that Ie corresponds to Eve’s knowledge about the en¬ 
coded key |[2). Accordingly, the most general attack that Eve 
can perform in the QFC consists of a joint interaction between 
the sent qubit and some auxiliar ancilla. Without loss of gen¬ 
erality, this interaction may be represented as 

U\i)t\e) = |0> t l4> + U>fl4>; '=0,1. 


( 2 ) 
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where U is a unitary operation acting on the joint Hilbert space 
of the ancilla and the qubit, and |e) is the ancilla state before 
the attack. The set {|i)^}, = o,i contains the eigenstates of the 
Pauli operator k.cr, which corresponds to the k direction in the 
Bloch sphere. Unitarity is guaranteed whenever the ancilla 
states {|4)}o<i ;<i fulfil the conditions: 

<4i4> + <4i4> = i. <4i4> + <4i4> = o. o> 

After the forward attack. Eve resends the qubit to Alice 
and stores her ancilla until the qubit is sent back through the 
QBC. In this way, the joint encoded states that she can ac¬ 
cess in the QBC are p AE '° = U(I A /2 ® |e)(e|)f/ 1 and p AE 4 = 
erf t/(I A /2®|e)(e|)f/^crf, withp A£ '° (p A£ h) being the state con¬ 
ditioned to the Alice’s encoded bit “0” (“1”). Following the 
definition of collective attack. Eve can extract the encoded in¬ 
formation by performing coherent measurements on any num¬ 
ber of qubits and ancillae that she considers convenient. To 
this aim, it is assumed that she has an unlimited resource of 
quantum memory at her disposition lf37ll . Accordingly, the 
expression for Eve’s information is given by ll35l : 

I E = max^f 

It/) 

( / AEIO, AEjl\ 1 j 

= max( P + P ) - \lS(p AE V) + 5(p^ 1 )]|, 

(4) 

where S(p) = Trp log 2 p is the von Neumann entropy and 
X is the Holevo quantity 11381 for the alphabet encoded into 
{p A£ l'},_o 1 . The maximization is taken over all possible Eve’s 
unitaries. 

Since the conditional density operator p AE ^' only differ 
of I A /2 ® |e)(e| by unitary transformations, we can write 
S(p AEli ) = S (I a /2 ® |e)<e|) = 1. Hence, 

I E = max \S (p AE ) - ll, (5) 

It/) L J 

withp A£ = i(p A£ l° +p A£ ' 1 ). 

To compute Eve’s information, in Eq. 0, we need first to 
obtain the eigenvalues of the Alice-Eve joint state p AE . We 
will perform this task employing the Gram matrix represen¬ 
tation ll30ll . For a mixed state (written as a mixture of non- 
orthogonal pure states) p = 2 /PiWdiViV Hi Pi = 1, the ele¬ 
ments of the Gram matrix, G, are defined as 


a suitable orthonormal basis is not obvious; and second, even 
if that were the case, computing the eigenvalues of a 8 x 8 
matrix is a considerably more difficult task than doing it for 
4x4 matrix. 

From Eq. 0, we deduce that the perturbation that Eve’s 
unitary, U, causes on the qubit state |0)^. (|l)j) is given 
by (e^jle^j) «e{ 0 |ej 0 )). Considering the generic form of a 
TWQKD protocol (described in Section [II] and Fig. 0 the 
set of Bob’s prepared states {|i/r,)} ; can be written as {|= 
{|0>t.H>t}fctf), where {k} is the set of Bloch sphere directions 
used in the Bob’s preparation. The fact that Eve has access 
to the state I A /2 in the forward channel means that Bob pre¬ 
pared |0)j. and 1 )j. with the same probability, regardless of the 
preparation basis direction choice, k. As aforementioned, we 
are assuming that the qubits are sent through a depolarizing 
channel and consequently 

<4i4> - <4oi4> = Qf’ ( 7 ) 

for any choice k e (k). Here Qf is the natural noise of the 
forward channel, which is simply the probability that Alice 
receives |0)^. (|1)^) if Bob prepared |1)^ (|0)^). In this way, 
Eq. 0 tells us that, in order to pass unnoticed. Eve is re¬ 
stricted to interactions whose perturbation equals Qf for all 
the transmitted states. Considering this constraint, we obtain 
in Appendix A the following expressions for the eigenvalues 
of p AE : 




1 ± 


1 ± 


A /( 1 -2<4[4» 2 + 4|<4l4)| 2 
a /(1-2Q / )2+4K4|4)P , 


( 8 ) 


each one with multiplicity 2. Equation 0 is then translated 
into 1 E = max.S’ (p AE ) - 1 = max S (p AE ) - 1, for fixed Qf. A 

|c/t i<4i4>i 

simple argument (see Appendix A) leads to conclude that the 
von Neumann entropy. 


S(P AE ) = -2[/l + log 2 (/l + ) + T_log 2 (T_)], 


takes its maximum when Kejj 0 lGo)l = 0. Thereby, 

max S (p AE ) — 1 + h(Qf) and 

1 ( 44 ^ 


Gij = y/PiPj(<Pi\<Pj). ( 6 ) 

We take advantage of the fact that the eigenvalues of G and p 
are the same (including their multiplicities) QOl . and that p AE 
is by construction a mixture of pure states. In the Appendix 
A we write explicitly this matrix, which is of dimension 4 x 
4, and compute its exact eigenvalues. Note that the a priori 
Hilbert space for the joint state p AE is of dimension 8, given 
that 4 ancilla states are required to fully describe the Eve’s 
forward attack, cf. Eq. 0. This entails a clear advantage of 
using the Gram matrix over the standard method (in which 
p AE is written in some orthonormal basis), i.e.: first, finding 


/ £ = /*(<4l4» = /*(£/). (9) 

In this case, Eq. 0 allows to determine Eve’s information 
in terms of the noise introduced along the z direction, (e fn |/ ()| ). 
This implies that Bob must prepare eigenstates of erf and Al¬ 
ice must measure such an observable in CM. This kind of pro¬ 
tocol is clearly non-deterministic since the encoding opera¬ 
tions, {I A ,cr^}, have no effect on the states {|0)g, |1)=}. In the 
next subsection we will see that, regardless of the number of 
preparation bases used. Eve’s information can not be less than 
the given by Eq. 0. 
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B. Generalization of the security proof to an arbitrary number 
of preparation directions 

Here we show that, if the previous protocol is implemented 
in a depolarizing channel, no preparation strategy can reduce 
Ie below the value corresponding to Eq. ©• To this aim we 
present an explicit eavesdropping attack that simulates a depo¬ 
larizing channel with noise Qf and provides Eve li(Qf) bits of 
information. Besides the condition /e/Y(eT|eT) = (ej 0 |e^ 0 ) = 
Qf, this attack satisfies the following equations: 


<4l4> = < e 5il e I I > = 0 ’ 

(10) 

o' 

II 

%f 

o 

%r 

ii 

o 

(id 

<4i4> = °’ <44) = !-2G/. 

(12) 


A general qubit pure state may be written as |Q) = 
sen(f)|0)| + e'^cos(f)|l)j, where 0 and 0 are the azimuthal 
and polar angles in the Bloch sphere, respectively. The effect 
of the forward attack is then 

C/|0)k) = |Q>|e(fl)> + |<T ± >|e(STJ>, 

where |Q ± ) = cos(f)|0X - e ,<f sen |l)j is the state or¬ 
thogonal to |G) and {|e(£T)), |e(^±))) are ancilla states asso¬ 
ciated to the Eve’s attack. The disturbance generated on |D) 
is (e(£2 ± )k(G ± )) = 1 - (e(£2)k(£T)), cf. Eq. (|3j. Taking 
into account Eqs. ([10|-([T2|, we show in the Appendix B that 

<e(QJk(C2J> = Qf- 

Thus, we have proved that the attack described by 
Eqs. (|T0|-([T2| fully simulates a depolarizing channel with 
characteristic noise Qf. On the other hand, Eq. ( flQ| ) implies 
that Ie - /ifXej^le^)) = h(Qf). Although this result could 
suggest that it is sufficient for Bob to prepare only eigenstates 
of erf, indeed at least one additional basis must be incorpo¬ 
rated into the preparation. As already mentioned, this is nec¬ 
essary because the encoding operations {I A ,crf} do not affect 
these prepared states (the eigenstates of erf). Furthermore, 
the transmission of non-orthogonal states is the key ingredient 
to guarantee the protection of the information. Accordingly, 
the simplest protocol whose security is established by Eq. 0 
could be one where the encoding is performed with the set 
{I A , erf) and Bob prepares the states {|0)j, |1 )j}j €( ^ } . The re¬ 
sults obtained in this section will be employed to prove the 
security of the LM05’ protocol in what follows. 

IV. SECURITY PROOF FOR THE EM05’ PROTOCOF 

The LM05’ protocol corresponds specifically to version 2 
of the “Qubit LM05 protocol, implemented with reverse rec¬ 
onciliation”, proposed in Ref. m). In this scheme the en¬ 
coding operations are {I A , <xf, o/J, cr(?} and Bob’s preparation 
is carried out with the states {|(%, 11 )*}* 6 {jcz}• Moreover, Bob 
measures the received state in the preparation basis, interpret¬ 
ing an unchanged state as the bit “0” and one flipped as the 


bit “1”. This implies that the protocol is deterministic, since 
he can always perfectly distinguish the encoded bit with his 
measurements. On the other hand, the operations {erf, <x A ) 
can cause a bit flip or act similarly as the identity, depend¬ 
ing on the preparation basis, k e {x, z|. Therefore, at the end 
of the quantum transmission Bob must reveal the preparation 
bases in order to Alice can infer all the encoded bits. It is 
the disclosing of such information what the authors term “re¬ 
verse reconciliation” in ED. Here we will consider that Bob’s 
choices and the corresponding to Alice in each mode of the 
protocol (EM and CM) are performed with equal probability. 
In CM she measures randomly the observables erf and erf to 
determine the forward noise. 

According to the the description of LM05’, there is not a 
unique Holevo quantity to be maximized for obtaining Eve’s 
information (Eq. 0). Instead of that, the states from which 
Eve can extract the encoding depend on the associated prepa¬ 
ration direction. Suppose for instance that the Bob’s cho¬ 
sen preparation direction was z. Then, pf £ '° = \[U(J. A ® 
[e)(e|)f/ t + erf f/(I A ® kXeD^crf] and p A£|1 = j[crjUQ A ® 
k)(e|)(Xcr^ + cr^C(I A ®k)(e|)tXcr^], given that the operations 
sub-set {crf,<xf} produce a bit flip while the sub-set {I A ,<xf} 
leave the state unchanged. In this case the state p AE turns out 
to be 

\ 

UI A ®\e)(e\uU 2 4f/I A ®kXe|t/V£ 

k w=x,y,z j 

(13) 

and the corresponding Holevo quantity, 

Xz = S(p AE )-S(p AE '°). (14) 

Equation ( fl4) follows from the fact that pf £ '* = <xfp A£ '°crf = 
crfp A£ '°crf and the von Neumann entropy is invariant under 
unitary transformations 1361 . The same kind of reasoning 
leads to the Holevo quantity corresponding to the Bob’s prepa¬ 
ration in the x direction: 

X x = S(p AE )-S(pf'°), (15) 

wherep A£| ° = \[U(I A ® \e)(e\)U' 1 + crf U(I A ® \e)(e\)U^]. In 
this way. Eve’s information is given by 

I E = maxi (v, +Xx) < I (max*, + max^) , (16) 

where the factor 1/2 stems from the fact that Bob uses each 

preparation basis with equal probability. The upper bound is 
due to the general relation max[/(x) + g(x)] < maxf(x) + 
maxg(x), for / and g arbitrary functions. 

The optimization problem involved in Eq. ( fl6| ) could, in 
principle, be a considerable task. This is so basically due 
to the fact that the Holevo quantities are subtractions of two 
terms, each one depending on the general unitary U employed 
in the eavesdropping attack. Moreover, the Gram matrix as¬ 
sociated to p AE would be of dimension 8x8, which prevents 
a possible analytical advantage associated to the use of such 
a representation. To circumvent this hindrance, we introduce 
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a slight modification to the protocol, thereby reducing its se¬ 
curity proof to that of the protocol considered in the previous 
section. Such a modification consists in additional classical 
information that Alice publicly reveals at the end of the quan¬ 
tum transmission, such as follows: 

• If the preparation direction was x and Alice used I A or 
erf, she announces that erf and erf were discarded. Sim¬ 
ilarly, if Alice used erf or erf, she announces that I A and 
erf were discarded. 

• If the preparation direction was z and Alice used I A or 
erf, she announces that erf and erf were discarded. Sim¬ 
ilarly, if Alice used erf or erf, she announces that I A and 
4 were discarded. 

Notice that in this scenario Eve is unable to obtain directly 
any information about the encoded bit. However, the encoded 
states that she can access in the QBC take a simpler form now. 
Consider the case when Bob’s preparation was along the x 
direction and Alice used I A . Thus, we have 

e A£| ° = U( I a /2 ® |e)(e|)t/ t , 

&f E[1 = orfUi I a /2 ® \e)(e\)U ] erf, (17) 

where we have designed the density operator by g instead of 
p to emphasize that these states correspond to the modified 
protocol. 

The corresponding Holevo quantity, x' x ~ + 

gf E],X )) ~ S(gf E ^°), takes exactly the same form when Alice 
performed erf or erf, due to the invariance of the von Neu¬ 
mann entropy under unitary transformations. Using the same 
reasoning, it is easy to obtain the Holevo quantity correspond¬ 
ing to the case when the preparation direction is z, whose the 
general expression is given by 

y w = S(pf E )-S(g AEI °); w = z,x, (18) 

with g AEI ° = gf EI ° and gf E = \[U{ I A ® \e)(e\)U' ] ' + of,U(I A ®> 
|e)<e|) U'erf,] ; W being the complementary direction of w, i.e., 
W — x if w = z and vice-versa. The associated expression for 
Eve’s information, I E , is the same of Eq. ( p~6] > with the modi¬ 
fied Holevo quantities. The bound appearing in that equation 
can be written as 

Ie<\(I z e +I x e ), 

where I", = max v' It is worthwhile to note that Ji corre- 

E m E 

sponds exactly to I E in Eq. © and hence I X E = /t«4l4»- 
To find the expression for I Z E , we can proceed in a way com¬ 
pletely analogous to the one leading to Eq. ©, writing the 
Gram matrix with the states {IeA)} instead of {|ef)| (see Eq. © 
and Appendix A). It is thus not difficult to grasp that the re¬ 
sult is I Z E = ^((eQjleQj)). In this way, the estimation of the 
noise ((e^le^)) allows to determine Eve’s informa¬ 

tion when the encoded states were prepared along the x (z) 
direction. Assuming a depolarizing channel we get 

Ie < ^[/t«4l4» + /t«4l4»] = h(Qf). (19) 


2. Encoding mode Quantum forward 1. Preparation EH3 




Figure 2. (Color online) Schematic illustration of the quantum part of 
the TWQKD six-state protocol (the classical communication channel 
is omitted). Alice (on the left side) and Bob (on the right side) per¬ 
form each of their possible choices with equal probability, i.e., basis 
direction k for the state preparation, (in EM) Alice’s encoding oper¬ 
ation, and (in CM) Alice’s measurement basis. 


At this point, we remark that the objective of the introduced 
modification is to simplify the security proof and by no means 
is necessary in practice. Actually, it potentially reduces Eve’s 
uncertainty about the encoding and therefore I E (Eq. G3> is 
an upper bound to the Eve’s information, I E , for the LM05’ 
protocol. Furthermore, such a bound coincides with the one 
calculated in fll9l employing other methods. On the other 
hand, we show in Appendix C that the attack represented by 
Eqs. (fT0)>-(fT2li makes such bound in Eq. ( fT~9l > tight, which im¬ 
plies that for the modified version Eve can in fact get h(Qf) 
bits of information. 


V. OTHER DETERMINISTIC TWQKD PROTOCOLS 
A. The TWQKD six-state protocol 

Considering the LM05’ protocol, we note that if besides z 
and x one includes the preparation direction y and Bob always 
measures in the preparation basis, the resulting scheme is still 
deterministic. The reason is that, as in the case of LM05’, 
the encoding operations {I A , cr^, cr^, o4} always flip or leave 
unchanged the prepared state depending on the preparation 
basis. Now let us suppose that Alice and Bob perform their 
choices according to a uniform probability distribution. The 
resulting scheme, which we term “TWQKD six-state” (given 
the use of the same preparation strategy of the six-state pro¬ 
tocol ED), had not been proposed to date, to the best of our 
knowledge. We leave the remaining details of the protocol 
identical to those of LM05’. Regarding the decoding, for ex¬ 
ample, Alice and Bob agree that a unchanged (flipped) state 
corresponds to the bit “0” (“1”). To that aim Bob must pub¬ 
licly disclose his basis preparation choices after the quantum 
transmission, so that Alice can know the effect of her opera¬ 
tions in each case. Furthermore, in CM Alice should measure 
any of the observables {<4, °f, 4) with equal probability, in 
order to determine the noise introduced along each direction. 
Figure |2]illustrates the quantum part of this protocol. 

Similar to the LM05’ protocol case, for the TWQKD six- 
state protocol there is a Holevo quantity associated to each 
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possible direction chosen by Bob: 

AT* = ^0 P AE ) - 5Oof 10 ); w = x,y,z, (20) 

where the Alice-Eve joint state p AE is given by Eq. <0 
with the conditional joint state p = |[t/(I A ® |e)<e|)C/ + + 
aiua A m<e\w^i w = x, y, z. Likewise, the optimization 
to obtain Eve’s information. If = maxi YL_, v , y w , is at least 

[U] J ,y ’ 

as difficult as doing it for LM05’ (Eq. (| 1 6[> J. Nevertheless, the 
security of the TWQKD six-state scheme immediately follows 
from that of LM05’, since the only difference is the usage of 
the additional preparation direction y and it constrains more 
Eve’s strategies (she must now cause the same perturbation 
not only along x and z but also along y). This implies that 
Eve’s information is also upper bounded by h(Qf), according 
to Eq. ( p~9| >. 

In Appendix C we compute the von Neumann entropies, 
S (p AE ) and S (p A£ '°), for the unitary transformation described 
by Eqs. <[T0])-<(T2j). The corresponding eavesdropping infor¬ 
mation is given by 

5Z/- = a + a- C/ ),(|f2|). (21) 

The right hand side of Eq. ( |2T| ) is identical to the expression 
for Eve’s information corresponding to the six-state protocol 
H2l [2811291 . This is remarkable if one considers that the same 
kind of states are prepared in both the six-state scheme and 
its TWQKD version. Moreover, the analysed attack is in fact 
one of the most powerful since it makes tight the bound in 
Eq. ([191., as we also prove in Appendix C. Based on these 
facts, we conjecture that Eq. 0 actually corresponds to I E 
for the TWQKD six-state protocol. We can summarize the 
results concerning the LM05’ and TWQKD six-state schemes 
with the following inequallity: 



Q j (Foward noise) 


Figure 3. (Color online) Comparison of the Alice-Bob Mutual Infor¬ 
mation I(A : B) (blue solid line) and Eve’s Information ( I E ) for dif¬ 
ferent protocols, as function of the forward noise (Qf). It is assumed 
that the overall noise (Q) and the forward noise coincide, which is 
the case if the QFC and the QBC are correlated (see, e.g., in Ref. 
(13 some comments at this respect)./^ for the generalized LM05 
protocol is plotted as a (dark-green) dotted line. The upper bound 
to I E for LM05’ protocol is represented by a (dark-yellow) dashed 
line. The lower bound to I E for the TWQKD six-state is drawn as the 
(dark-red) dash-dotted line. 


for the attack described by the following conditions: 

<4)l4> = < e oi[ e n> = 0’ (23) 

<44> = <4l4> = 0. (24) 

<44> = °’ <44> = 1 - <44>- ( 25) 


2-3 Q f 
2(1 - Q f ) 

< 4 M05 ’ < h(Qf). (22) 

These bounds are plotted in Fig. [3] as well as the mutual in¬ 
formation between Alice and Bob (I(A : /()), and the eaves¬ 
dropping information (I E ) for the LM05 protocol. 


< I 


TWQKD six-state 


Qf + 0-Q f )h 


B. Generalized version of the LM05 protocol 


Now let us consider a TWQKD protocol in which Bob pre¬ 


pares states from the set 




i.e., any state on the perpendicular plane to the z direction 
of the Bloch sphere, and Alice performs the encoding with 
\U A )i = {I A ,cL?}. Such a protocol is clearly deterministic and 
can be considered as a generalization of the LM05 protocol 
M, which only uses two bases for the preparation, e.g. cr x 
and cry. We will show that this generalized protocol does not 
have any advantage over the standard LM05, within the as¬ 
sumption that the channel used to transmit the states is depo¬ 
larizing. We start computing the eavesdropping information 


This attack only differs from the one represented by Eqs. m- 
m concerning the value of the element (c^le^). In addition, 
we write ) instead of Qf because ^! I!) is not the 

disturbance measured in this protocol. 

Considering that the state |0) = ^ (|0) + e ,,s [l)) is equal 
to |0) (defined in Section III B) for 6 = it/ 2, we can use 
Eq. ( |B3| > from Appendix B to compute the perturbation that 
the attack defined by Eqs. (|23|)-(|25j> introduces on such a 
state. Expressing the attack unitary operation as U\<p)\e) = 
\(f>)\e(<p)) + \(p±)\e(<p±)), with \(p ± ) being the state perpendicular 
to \<p ), we have 


+ sen2 (^) cos2 (^)<4l4> 

+ 2sen 2 (^) cos 2 (^) <4 4 > 

+ cos 2 (^)s en2 (^)<efil4> 

+cos4 0 (1 ~ < 44» = 1 ~ 



2 
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where Eqs. (|23j)-(|25j) have been employed. Thus, using the 
unitarity condition, we have (e(cp_ L )\e((p ± )) = (ej 1 |e5.)/2. 

Using this result and the fact that, from Eq. ( |23] >, this at¬ 
tack provides Eve hde^Ae^Q) bits of information (it fulfills 
the condition to get Eq. Q), we get 

h = h (2(e(^j_)|e(0j_)» - h(2Q f ). (26) 

We have taken into account that (e(0j_)[e(0j_)) must coincide 
with the forward noise. The expression in Eq. ( |26| ) is exactly 
the found for the LM05 protocol in E6l and therefore we have 
proved that it is not possible to improve the protocol security 
with this extended version on the number of preparation basis. 


CONCLUSIONS 

We have studied the performance of TWQKD protocols 
that distribute a secret key by means of non-orthogonal qubit 
states. For the security analysis we have used techniques 
whose application is new in the context of secure communi¬ 
cations, to the best of our knowledge. Specifically, we em¬ 
ployed a matrix representation l30l that allows to easily com¬ 
pute the eigenvalues of certain density operators, involved in 
the determination of the amount of the eavesdropping infor¬ 
mation. In this way, a simple calculation leads to Eq. 0 
which is the more important expression for the posterior anal¬ 
ysis. With this equation we provided a new (alternative) se¬ 
curity proof for a protocol proposed in Ref. im (that we 
have named LM05’), obtaining an upper bound to the eaves¬ 
dropping information that coincides with the previous result 
in |fl9l . Moreover, we proposed a novel protocol (TWQKD 
six-state) that is at least as secure as LM05’ and computed 
an analytical lower bound to the eavesdropping information. 
Such a bound equals the maximum eavesdropping informa¬ 
tion corresponding to the six-state scheme ||2] [28] [29]. We 
remark that the security of the TWQKD six-state protocol is 
possibly better than that of the LM05’ protocol, since an ad¬ 
ditional preparation basis is used by Bob, and therefore our 
lower bound could be tight. Finally, we showed that the in¬ 
clusion of more than two preparation bases does not improve 
the security of the LM05 protocol |26l . The construction of 
a full security proof for the new TWQKD six-state protocol 
proposed here as well as its experimental analysis and tests 
are interesting directions for a future research. 
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Appendix A: von Neumann entropy of the state p AE (Eq. Q) 

In this appendix we maximize the von Neu¬ 
mann entropy for the Alice-Eve joint state p AE = 


\ [t/(I ® kXeDt/f + of U(I ® \e)(e\)UW ], assuming that 

<<4l«4> = <4)l4)> = Qf is fixed - Usin 8 E q- 0- with k = z, 
and Eq. the corresponding Gram matrix is explicitly 
written as 

1 0 1-2 Q f 

G= I 0 1 2<4i4> 

4 1-2 Q f 2(414) 1 

U<44> 2 ( 2 / -1 o 

The eigenvalues of G are given by 

± A /(i-2e / ) 2 +4K4i4>p], 


2 Qf - 1 
0 

1 , 


which implies that the von Neumann entropy S [p A£ ] will be a 
function of Qf and 1(414^- E° r a fixed Qf we obtain 

S(p AE ) = -2[T + (x)log 2 (T + (x)) + T_(x)log 2 (T_(x))], 

with x = K44^- T a ld n g the derivative with respect x, it 
is easy to see that S ( p AE ) is monotonically decreasing in the 
interval (0,1) and therefore S (p AE ) takes its maximum at x = 
0. 


Appendix B: Disturbance on any qubit pure state caused by the 
attack described by Eqs. (|To]»-(JT2j 

Using the expression for a general qubit pure state, |Q) = 
sen(f)|0)t + e'^cos (®) |l)s, given in Section III B, we can 
write the action of an eavesdropping interaction U as 

U(|Q)|e» = sen(^£/|0)j|e> + ^cos(^) t/|l),|e) 

= sen (^{|°Xl 4 > + [ 1 > 2 l 4 >} 
W*cos(^){|0>d4> + |l>d4>)’ (BD 

were we have considered the linearity of U and Eq. 0 has 
been used, with k = z. 

Taking into account that Q) and its orthonormal state, 
|Q ± ) = cos(f)|0)s - e"^sen(®) |1}?, are defined in terms of 
the states {|0)j, |l)j), we have 

|0)j = sen (^ j |Q> + cos (^) |fi x ), 

[1)2 = e-* (cos Q |£2) - sen Q |Q X )) . (B2) 

Therefore, using Eq. ( |B2| i, we can rewrite Eq. © as 
Ume) = |G)|e(Q)) + |Q ± )k(QJ), 

with 

k(Q)) = sen 2 (^4) + sen(^cos(^e" ,0 l4> 

+ e'^cos (^) sen (^) l4> + cos2 (^) 4)’ (B3 ) 
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and a similar expression holds for |e(f2j_)). 

If the states {|et.)} satisfy Eqs. then 

<e(Q)|e(Q)> = sen 4 ^j(l - Q f ) + sen 2 (^)cos 2 ^j<eg 0 |ef 1 ) 
+ 2sen 2 ( ^ ) cos 2 ( ^ ) 2/ 

+ COs2 (f ) sen2 (I) <e ? l|e oo ) 

+ cos 4 (^)(l-e / )=l-Q / . 

Hence, by the unitarity of U , (e(0 ± )|e(Qj_)) = 1 — 

<e(Q)k(G)> = Q f . 


Appendix C: Probable expression for Eve’s information in the 
TWQKD six-state protocol 


channel, we get 


1 



1-2 Q f 
*( 1 - 22 /) 
1-26/ 


1-26/ -*(1-26/) 
1 -*(1-26/) 
*■( 1 - 26/) 1 
1-26/ -i(l - 26/) 


1-26/ 

1-26/ 

*'(1-26/) 


1 1-26/ *(1-26/) -d-26/) 

( 2 ,_ 1 1-26/ 1 *(1-26/) -d-26/) 

4 -*(1-26/) -i(l - 26/) 1 *-(1-26/) 

-d-26/) -d-26/) -*d-26/) 1 

One finds that the eigenvalues of G (1) and G 1 (2) 3 are {1 - 
1.56/, 0.56/), the first one having multiplicity 3. Therefore, 

3 2-3 Q f 

S(P AE ) = 2 - -fi/log 2 fi/--l°g 2 (2 - 3 Q f ). (Cl) 

For the analysed attack we already know that S (p' 4/4 °) = 
l+Zide^le^j)) = 1 +h(Qf), according to Eq. (p~0l>. On the other 
hand, the sets {U\i)i\e),cr^U\i)i\e)}i and {E/|/)?k), cr^f/|i)jk)}; 
determine the Gram matrices needed to compute S |p 4/4 ° | and 
S [py £ '°]- The obtained expressions are 


Here we compute the eavesdropping information for the 
TWQKD six-state protocol, when the attack is given by 
Eqs. m-( 12 ■ The average over the associated Holevo quan¬ 
tities, Eq. (20 1 , is: 


5 2 


G, = ; 


corresponding to p x 1 , and 


1 0 0 1 - 26/ 4 
0 1 1-26/ 0 

0 1-26/ 1 0 

1 -26/ 0 0 1 

A£|0 


Gy = - 

• 4 


-i 0 0 

0 -* (1-26/) 

0 -d-26/) -*• 

(1-26/) 0 0 


-(1-26/)' 

0 

0 

—i 


The elements of the Gram Matrix correspond¬ 
ing to p AE result from the scalar products between 
the states {t/|i)jk),< 7 ^t^l*')?k)}i>, being U the at¬ 
tack described by Eqs. (10)-|[T2). For this at¬ 
tack it turns out that the sets .... I^ 1 ')) = 

{t/|0> ? k), aiU\l)t\e), (T$U\l)t\e), of £/|0>ik» and 

{|^ 2) ),...,l^ 2) » = {f/| i>=k>, £/|0)tk>, erf t/|0)jk>, c/| i>zk>) 

are orthogonal. We denote the Gram Matrices associated to 
the first and second sets as G (1, and G <2) , respectively, and 
their elements are (see Eq. ([6]i) Gf) = k = 1,2. 

The orthogonality property implies that the eigenvalues of p AE 
are derived from the corresponding to G (1, and G (2) . Using 
Eqs. (p~0T>-(jT2]> and the usual assumption of the depolarizing 


for Py £ '°. The eigenvalues of G x and G y are {0.56/, 0.5(1 - 
Q/)}, each one with multiplicity 2. Therefore, 

S (Ph £ '°) = 1 + h(Q f )\ w = x,y,z. (C2) 

From Eqs. ( |C1[ ) and ( |C2| i, the information that Eve gets us¬ 
ing this attack is thus 

Lld' =e/+a -Mra)- 

Notice in particular that Eq. ( |C2| entails that the bound 
Eq. ( fl9l > is tight. 
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